The Grav API plugin accepts a JWT provided in the ?token= query parameter on every /api/v1 route, including those that modify data. As a result, valid access tokens are written to server, CDN, and proxy logs, settle in browser history, and appear in Referer headers, exposing them to anyone who can read those records. An attacker who obtains a logged token can impersonate the owner and perform any API action granted to the token holder, effectively bypassing authentication requirements and potentially altering site content.

Versions of the Grav API plugin older than 1.0.0‑rc.16 are affected. The issue applies to installations of Grav CMS that use the getgrav:grav‑plugin‑api plugin before that release.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation so far. Exploitation requires that an attacker has access to logs, CDN records, or Referer headers, or can induce a user’s browser to send a request containing a leaked token. If such exposure occurs, the attacker can reuse the token to gain the bearer’s privileges, which can include full API access and state changes.